# Watch mode

> How Cloak Watch's watch mode checks installs within a second and looks for programs running from paths Mac stealers use, what it reads, and what it costs.

Source: https://docs.subcloak.com/cloak-watch/watch-mode/

Added in Cloak Watch 1.2.0.

Watch mode is how Cloak Watch notices an attack while it's happening, not just at the next scan. It follows changes to the files attacks write, such as launch agents, shell profiles and Python startup files, and once a minute it looks for programs running from places Mac stealers use. Both are on by default and run on your Mac only.

*[Screenshot: Settings › General: Scanning with Watch for changes as they happen and Last full scan, then Watch mode with Check running programs on, Last check: 512 programs, nothing unusual. About 1 ms of CPU a minute, and Apple XProtect: Rules 5368, updated 2 days ago]*

## Turn it on or off

Both switches are in [Settings › General](https://docs.subcloak.com/cloak-watch/settings/#general):

| Setting | Default | What it does |
|---|---|---|
| **Watch for changes as they happen** (under **Scanning**) | On | Checks a project within seconds of an install or a change to its settings. Off, Watch only scans once a day and when you ask. |
| **Check running programs** (under **Watch mode**) | On | "Once a minute, while Watch is watching for changes, it looks for programs running from places Mac stealers use: hidden files in your home folder, temp folders and paths from published incidents. It never reads what they do." It's greyed out while **Watch for changes as they happen** is off. |

Under **Check running programs**, a line says what the last check found, for example **Last check: 512 programs, nothing unusual. About 1 ms of CPU a minute.**, or **Off.**

## Changes to files

With **Watch for changes as they happen** on, Watch follows file changes in your code folders and in the places attacks persist or leave files: launch agents and daemons, shell profiles, the folders that hold Python startup files, credential files such as `~/.ssh` and `~/.aws`, wallet apps in `/Applications`, and AI agent, editor and MCP configs. After a burst of changes settles, it rechecks only what changed. For example:

- a `.pth` file that `pip install` added is checked about a second after the install finishes;
- a known-bad npm version becomes a Fix now card in about a second;
- a wallet app replaced in `/Applications` is checked as soon as it lands.

Watching files costs nothing while nothing changes. See [How Watch keeps checking](https://docs.subcloak.com/cloak-watch/security-and-faq/#how-watch-keeps-checking).

## Running programs

Once a minute, at low priority, Watch lists the programs running as you and looks for two things:

| Card | Tier | When |
|---|---|---|
| [PROC-1](https://docs.subcloak.com/cloak-watch/detections/#proc-1): "Running now: a program … uses" | **Act now** | A program runs from a path a published incident names, such as an AMOS stealer backdoor's `~/.helper`, XCSSET's `~/.root`, or `~/.n2` and `~/.n3` from the InvisibleFerret and BeaverTail malware. For scripting tools (`python`, `node`, `bash`, `osascript`, `perl`, `ruby` and others), Watch also checks whether the script they run is at one of those paths. |
| [PROC-2](https://docs.subcloak.com/cloak-watch/detections/#proc-2): "Unsigned program running from …" | Review | An unsigned or ad-hoc-signed program runs straight from a temporary folder, or as a hidden file in your home folder. |

When a file an incident names has its own card and is also running, that card says "It's running now". To stop the program, use **Stop…** in [I think I've been hit](https://docs.subcloak.com/cloak-watch/respond/#1-contain).

For each program, Watch reads only its path, its user and start time, and its code signature, plus, for scripting tools, which script they run. It doesn't record what programs do, and nothing about them leaves the Mac.

> **What it can miss:**
> A program that starts and finishes between two checks isn't seen. Watch mode is a second net, not a replacement for not running the bad install in the first place: a [cooldown](https://docs.subcloak.com/cloak-watch/install-guard/) keeps most bad versions off.

### What it costs

On a developer Mac with about 580 running programs, each check took about 1.6 ms of CPU in Subcloak's tests. Run as Watch runs it, once a minute at low priority, ten minutes of checks used 53 ms of CPU in total.

## Apple XProtect

macOS has its own malware rules and remover, XProtect, which Apple updates in the background. Watch shows its state; it doesn't copy or use Apple's rules.

- **Settings › General › Watch mode › Apple XProtect** shows the rules version and when they were installed, for example **Rules 5368, updated 2 days ago**, with **· updates off** when automatic updates are off.
- [MAL-2](https://docs.subcloak.com/cloak-watch/detections/#mal-2) raises "macOS won't install XProtect updates by itself" (Review) when **Install Security Responses and system files** is off in **System Settings › General › Software Update › Automatic Updates**, and "XProtect's rules are N days old" (FYI) when they're more than 60 days old.
- The [Verify step](https://docs.subcloak.com/cloak-watch/respond/#4-verify) of **I think I've been hit** also shows XProtect Remediator's version and when it last ran.

## Wallet apps

Crypto stealers swap wallet apps for look-alikes. Watch checks Ledger Live, Trezor Suite, Exodus, Electrum, Atomic Wallet, Coinomi, Guarda, Wasabi Wallet, Sparrow, Bitcoin Core, Keplr and Monero GUI in `/Applications` and `~/Applications`, and raises [MAL-1](https://docs.subcloak.com/cloak-watch/detections/#mal-1) at Act now when one isn't signed by its developer, was changed after it was signed, or its developer changed since Watch first saw it. Watch reads only the app's `Info.plist` and signature, never the wallet's data.

The fix moves the app to Quarantine. Then reinstall it from the vendor, and from another device, move your funds to a new wallet: a swapped wallet app may have taken your recovery phrase.

## From Terminal

- [`watchctl processes`](https://docs.subcloak.com/cloak-watch/watchctl/#processes) runs the running-programs check once and prints any hits.
- [`watchctl xprotect`](https://docs.subcloak.com/cloak-watch/watchctl/#xprotect) prints XProtect's state.

## Related

  - [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/): Stop a program and clean up.
  - [Detection catalogue](https://docs.subcloak.com/cloak-watch/detections/#running-programs-proc): PROC-1, PROC-2, MAL-1 and MAL-2.
  - [Settings](https://docs.subcloak.com/cloak-watch/settings/#general): Settings › General.